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PROBABILISTIC  APPROACH  TO  mP  ASSESSMBJT 


ABSTRACT 

^The  development  of  nuclear  QtP  hardness  requirements  must  account  for 
uncertainties  in  the  environment,  in  interaction  and  coupling,  and  in  the 
susceptibility  of  subsystems  and  components.  Typical  uncertainties  of  the 
last  two  kinds  are  briefly  sumnarized,  and  an  assessment  methodology  is 
outlined,  based  on  a  probabilistic  approach  that  encompasses  the  basic 
concepts  of  reliability.  It  is  suggested  that  statements  of  survivability  be 
made  compatible  with  system  reliability.  Validation  of  the  approach  taken  for 
simple  antenna/circuit  systems  is  performed  with  experiments  and  calculations 
that  involve  a  Transient  Electromagnetic  Range,  numerical  antenna  modeling, 
separate  device  failure  data,  and  a  failure  analysis  computer  program. 

1.0  INTRODUCTION 


The  development  of  nuclear  electromagnetic  pulse  (QIP)  hardness 
requirements  and  the  specification  of  EMP  hardening  or  protection  for  a  system 
must  account  for  uncertainties  in  all  areas  from  the  EMP  environment  to  system 
behavior.  For  example,  uncertainties  exist  in  statements  about  the 
environment,  particularly  how  this  environment  interacts  with  and  propagates 
throughout  the  system.  Similarly,  there  are  fundamental  uncertainties  in  the 
components,  units,  and  subsystems  that  are  to  be  subjected  to  those  uncertain 
environments.  Uncertainties  appear  in  the  form  of  random  variations, 
systematic  errors,  and  judgmental  factors.  This  paper  briefly  reviews  some  of 
the  uncertainties  in  the  areas  of  interaction  and  coupling,  and  susceptibility, 
and  it  suggests  in  some  detail  an  approach  that  can  deal  with  such 
uncertainties  in  assessing  a  system  for  hardness  specification.  This  is  by  no 
means  a  complete  review,  but  we  obtained  information  on  some  major  programs 
from  the  EMP  Lead  Laboratories  of  the  Services  and  from  some  of  their 
contractors.  The  suggested  approach  is  probabilistic  in  nature  and 
encompasses  the  basic  concepts  of  reliability  in  making  statements  concerning 
hardness  and  survivability. 
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2.0  GENERAL  NATURE  OF  UNCERTAINTIES 


Uncertainties  arise  in  all  phases  of  vulnerability  assessment  euialysis, 
due  to  model  inadequacies,  testing  uncertainties,  lack  of  ccmiplete  knowledge 
of  system  parameters,  etc.  These  uncertainties  must  be  accOTonodated  in  any 
analysis,  whether  it  be  a  deterministic  worst-case  analysis  or  a  probabilistic 
analysis  where  the  uncertainties  are  considered  to  be  nondeterministic. 

In  risk  assessment  programs,  uncertainties  are  classified  into  several 
types.  For  vulnerability  assessment,  three  types  of  uncertainties — random, 
systematic,  and  judgmental — can  be  defined.  Although  there  is  no  universal 
agreement  on  the  definitions  of  these  terms  or  even  for  the  need  to 
differentiate  among  different  types  of  uncertainty,  it  is  frequently 
interesting  and  important  to  distinguish  between  uncertainties.  In  particular, 
it  may  be  of  interest  to  separate  the  effect  of  uncertainties  due  to  "inherent" 
random  variation  in  the  properties  of  the  system  from  the  effect  of  those  in 
the  analysis  techniques.  The  latter  can  sometimes  be  reduced  by  improved 
techniques,  whereas  the  former  cannot.  Below  we  suggest  a  use  of  terms  that 
would  be  appropriate  for  vulnerability  assessment. 

2.1  RANDOM  UNCERTAINTIES 


Random  uncertainties  are  variations  in  measured  response  due  to  inherent 
natural  variations  in  the  physical  properties,  operation,  or  behavior  of  a 
physical  entity.  Thus,  the  variation  in  the  susceptibility  (response  level  at 
which  failure  occurs)  of  like  components  is  considered  a  random  variation 
(uncertainty).  This  variation  has  many  causes,  such  as  manufacturing 
variation,  variations  in  the  basic  elements  within  the  component,  etc. ,  and  it 
includes  measurement  variation.  Similarly,  random  variation  in  an  incident 
electric  field  can  be  due  to  environmental  variation,  randOTi  variation  in  the 
source,  directional  variations,  etc.  All  of  these  variations  are  outside  the 
direct  control  of  the  analyst  and  will  always  be  a  source  of  uncertainty  in 
the  analysis. 
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2.2  SYSTEMATIC  UNCERTAINTIES 


Systematic  uncertainties  are  variations  in  response  due  to  imperfect 
modeling,  testing,  design,  analysis,  etc.  The  variation  introduced  into  the 
analysis  by  modeling  (analysis,  computer-  or  scale-model  testing)  introduces  a 
constant,  although  unknown,  uncertainty  in  response.  (For  excunple,  any 
mathematical  model  of  coupling  is  only  an  approximation  to  the  real  system.) 
This  constant  uncertainty  in  the  response  exists  as  long  as  the  model  is  used 
in  the  vulnerability  assessment  analysis. 

2.3  JUDGMENTAL  UNCERTAINTIES 

Judgmental  uncertainties  are  variations  in  response  introduced  by  using 
subjective  opinions  about  unknown  parameters.  Frequently,  many  of  the 
parameters  in  a  vulnerability  assessment  are  unknown  and  unobtainable.  Thus, 
it  is  necessary  to  depend  on  the  judgment  of  experts  for  the  likely  values  of 
the  parameters.  Anyone  who  makes  such  a  judgment  will  be  doing  so  without 
complete  knowledge,  thus  introducing  uncertainty  into  the  assessment.  For 
example  a  vulnerability  assessment  of  a  system  must  account  for  the 
envircximent.  Since  it  is  impossible  to  know  all  details  about  the  environment 
some  judgments  must  be  made.  Although  judgmental  uncertainty  influences  the 
analysis  in  much  the  same  way  as  a  systematic  uncertainty,  a  separation  of  the 
uncertainty  due  to  modeling,  testing,  etc.,  from  that  introduced  by  subjective 
judgments  is  clearly  advisable  in  most  situations. 


3.0  UNCERTAINTIES  IN  COUPLING  AND  SUSCEPTIBILITY 

3.1  INTERACTION  AND  COUPLING 

3.1.1  Nature  of  Uncertainties 

Vulnerability  assessment  includes  the  evaluation  of  EMP-induced  currents 
on  conductors  that  might  direct  the  energy  to  susceptible  circuitry.  Various 
approaches  are  used  to  evaluate  these  currents,  the  most  popular  of  which  are 
full-scale  simulation  tests,  computer  simulations,  and  scale-model  tests 
supplemented  with  analysis.  Another  alternative  to  full-scale  testing  is  the 
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technique  of  "current  injection"  at  certain  points  of  the  system.  A  fifth 
method  of  assessment  is  the  evaluation  of  the  BMP  response  of  a  similar,  often 
simpler,  system.  (The  Lawrence  Livermore  Laboratory  (LLL)  has  published  a  set 
of  data  on  external  coupling  of  BMPs  to  generic  structures.^  These  data 
provide  estimates  of  BMP-induced  current  levels.)  In  several  assessment 
efforts,  more  than  one  technique  has  been  used. 

In  the  absence  of  coupling  data  from  actual  high-altitude  nuclear  bursts, 
heavy  reliance  is  placed  on  data  generated  from  full-scale  simulation  tests. 
Such  tests  have  also  been  used  to  validate  other  simulation  techniques. 
However,  full-scale  simulation  tests  are  in  themselves  prone  to  uncertainties, 
which  are  reviewed  and  discussed  below.  There  is  a  large  amount  of  data  on 
simulators  and  on  the  taking  and  processing  of  data  from  them. 

The  nature  of  the  source  of  interaction  and  coupling  uncertainties  are 
closely  connected  to  the  type  of  system  being  evaluated.  For  excunple.  Army 
communication  equipment  can  be  tested  in  a  HBMP  (high-altitude  electromagnetic 
pulse)  environment  similar  to  that  anticipated  in  field  use,  with  the  possible 
exception  of  very  long  lines  connected  to  the  equipment.  In  contrast,  most 
aircraft  and  missile  tests  are  conducted  on  the  ground  while  attempting  to 
simulate  the  vehicle  in  a  flight  condition.  Problems  of  extrapolating  the 
test  data  to  the  desired  operational  case  is  less  severe  when  the  system  is 
more  closely  simulated  in  both  its  physical  configuration  and  general 
operating  environment. 

Important  coupling  paths  for  Army  ground  communication  equipment  are  from 
the  external  field  to  cables  and  antennas,  and  frcxn  these  to  the  internal 
equipment.  For  aircraft  and  missiles,  the  BMP-induced  effects  enter  the 
system  through  various  points-of-entry  (POE) ,  such  as  apertures  and  external 
antenna  systems.  The  aircraft,  however,  is  still  a  localized  system,  whereas 
cables  of  communication  systems  may  run  for  kilometers. 

The  coupling  assessment  of  aircraft  has  relied  more  heavily  on 
system-level  simulation  tests  then  on  less  successful  analytical  and  computer 
simulation  techniques.  On  the  other  hand,  the  computer  simulation  approach 
has  been  more  successful  for  Army  communication  equipment.  Various  codes  have 
been  developed  and  validated  with  simulation  tests  in  well-controlled 
configurations,  then  used  to  predict  currents  on  long  cable  runs  where 
simulator  tests  are  not  feasible. 
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The  Navy  has  also  performed  many  coupling  assessments  on  various  ships, 
using  the  EMPRESS  EMP-simulation  facility.  The  EMP  fields  couple  to  the 
various  antenna  systems  and  cables  aboard  the  ships,  which  in  turn  propagate 
the  energy  conductively  through  apertures  to  susceptible  circuitry  within  the 
hull  of  the  ship.  The  direct  coupling  of  the  EMP  fields  to  internal  cables  is 
minimal,  in  contrast  to  aircraft  coupling  modes.  This  property  of  ships  makes 
scale-model  testing  for  evaluation  of  coupling  an  attractive  alternative  to 
full-scale  ship  simulation  tests. 

Solution  of  the  coupling  problem  by  computer  methods  is  also  attractive 
because  of  the  availability  of  many  efficient  numerical  techniques  and 
computer  programs.  However,  the  greatest  accuracy  has  been  obtained  in  the 
prediction  of  external  coupling  levels,  such  as  coupling  to  external  antennas 
(free  space  and  lossy  ground)  and  to  the  external  conducting  surface  of  an 
aircraft  or  missile.  For  external  coupling,  much  validation  work  has  been 
performed,  so  that  the  numerical  modeling  techniques  can  be  used  with  high 
confidence.  There  has  apparently  been  only  limited  success  in  the  prediction 
of  internal  cable  currents,  particularly  the  EMP-induced  currents  in 
individual  wires.  Very  extensive  and  complete  descriptive  information  is 
needed,  unless  the  configurations  are  quite  simple.  Internal  coupling 
estimations  have  been  attempted  for  complicated  systems  (aircraft  and  ships) , 
and  aircraft  predictions  have  been  validated. 

Scale-model  tests  have  been  used  quite  extensively  for  external  coupling 
predictions,  and  this  technique  has  been  validated.  Recently,  the  scale-model 
approach  has  also  been  used  for  making  some  internal  coupling  predictions  for 
a  ship,  and  the  results  indicate  much  promise  for  this  approach.  Such 
scale-model  tests  should  be  quite  successful  and  accurate  as  long  as 
geometrically  small  details  in  the  full-scale  system  can  be  negl#»cted.  This 
implies  that  very  small  apertures  cannot  be  allowed  to  become  major  POE  for 
energy  into  the  interior  of  the  ship.  For  this  reason,  the  technique  should 
be  quite  useful  for  ships,  but  less  useful  for  aircraft.  However,  scale-model 
tests  are  useful  to  predict  external  coupling  to  the  aircraft. 

We  do  not  wish  to  imply  here  that  one  and  one  only  coupling  technique  has 
been  used  for  each  system.  This  discussion  refers  only  to  the  more  common 
methodology  used.  Coupling  data  for  aircraft  for  instance  have  been  generated 
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by  computer  simulation  when  such  data  were  not  available  or  were  difficult  to 
obtain  with  system  simulation  tests.  An  example  might  be  an  aircraft  with  a 
long,  trailing  wire  antenna. 

3.1.2  Typical  Uncertainties 

In  this  section,  we  review  typical  uncertainties  in  the  various  coupling 
assessment  techniques.  We  place  emphasis  on  "reasonable  and  achievable" 
accuracies,  based  on  well-run  tests  or  analyses.  The  emphasis  is  on 
uncertainties  in  amplitude  in  the  time  dcxnain,  since  electronic  vulnerability 
is  usually  much  more  sensitive  to  changes  in  amplitude  than  to  small  changes 
in  frequency  content. 

A.  Full-Scale  System  Tests.  The  uncertainties  in  full-scale  tests  include 
measurement  errors,  extrapolations  of  test  data,  and  intrasystem  and 
intersystem  variations. 

Measurement  Uncertainties.  These  include  simulation  variation  errors 

(from  shot-to-shot) ,  instrumentation  errors,  and  data  processing  errors. 

Simulator  field  errors  af^ear  to  be  primarily  due  to  shot-to-shot 

variations  in  the  dischcurge  circuits,  waveform  variations,  and  variations  in 
2  3 

nonprincipal  (l/R  -1/R  )  components.  The  last  two  appear  to  be  minor. 
Examination  of  a  dozen  or  so  simulators  suggests  that  a  reasonable  and 
achievable  error  due  to  simulator  field  uncertainty  is  +2  dB. 

Instrumentation  errors  include  those  in  current  and  charge  sensors; 
circuit  elements  such  as  cables,  alternators,  and  power  dividers;  integrators 
and  differentiators;  oscilloscopes;  records;  and  such  subsystems  as  microwave 
telemetry,  screenboxes,  ADSET  data  acquisition,  and  a  similar  DASET  system. 

A  well-controlled  and  calibrated  instrumentation  system  has  about  the 
smallest  error  and  uncertainty  of  any  aspect  of  a  coupling  assessment, 
according  to  studies  by  several  companies.  For  example,  sensor  errors  can  be 
held  to  1  dB,  as  can  integrator  cuid  differentiator  errors  up  to  50  MHz;  scope 
errors  can  be  made  almost  negligible.  A  good  microwave  telemetry  or  screenbox 
system  will  have  less  than  1  dB  error  over  its  dynamic  range;  an  ADSET  or 
DASET  data  acquisition  system  can  be  similarly  designed.  An  overall  error  of 
+3  dB  is  reasonable  for  an  entire  instrumentation  system. 
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Data  processing  errors  can  occur  during  the  manipulations  of  the  recorded 
raw  data  (digitization,  Fourier  transformation,  etc.),  which  produce  the  final 
scope,  film,  or  recorded  f-  or  t-domain  responses.  Most  of  the  individual 
errors  are  small. 

Data  processing  error  estimates  have  ranged  from  +6  dB  in  one  system  to 
essentially  zero  in  another  system,  in  frequency  intervals  extending  to  1  GHz. 
The  maximum  error  in  a  DASET  or  ADSET  processing  system  is  about  dB,  in  the 
absence  of  nonlinear  effects,  which  can  in  principle  be  removed  from  the  data. 
This  seems  to  be  a  reasonable  and  achievable  figure. 

Extrapolation  Uncertainties.  The  measured  wire  currents  from  a  test 

program  must  be  extrapolated  to  threat  conditions,  and  this  usually  introduces 

additional  uncertainties.  The  extrapolation  provides  corrections  for  incident 

field  amplitude  and  wave  shape,  incidence  angle,  and  polarization,  ctnd  a 

change  from  ground  test  environment  to  threat  environment.  The  ground  plane 

correction  can  be  important  for  aircraft  assessment  when  in-flight  currents 

are  to  be  extrapolated  from  test  data.  Ground  conductivity  effects  can  also 

be  important  when  the  system  to  be  tested  is  to  be  deployed  in  physical 

environments  quite  different  from  those  at  the  simulator  site.  For  instance, 

estimates  of  the  effect  of  ground  conductivity  on  the  reflected  wave  for 

various  angles  of  the  incident  wave  and  antenna  height  indicate  that  it  could 

cause  at  least  a  4-dB  change  in  coupling  response. 

For  an  aircraft  where  free-field  penetration  into  the  interior  through 

2 

POE  is  the  critical  means  of  internal  excitation,  Rockwell  has  used  the 

surface  magnetic  field  (H  )  at  the  various  POE  as  the  extrapolation 

s 

quantity.  When  more  than  one  POE  may  be  driving  a  given  internal  wire  to  an 
unknown  extent  compared  to  other  POE,  the  resultant  uncertainty  is  referred  to 
by  Rockwell  as  the  POE  location  error,  cm  additional  source  of  extrapolation 
uncertainty. 

In  Rockwell's  assessment  method  1  (by  computer  program)  the  extrapolation 

ratio  H  (threat)  (simulator)  is  estimated  by  computer 

s  s 

programs.  The  inherent  error  has  been  evaluated  by  comparison  with  Air  Force 
Weapons  Laboratory  (AFWL)  simulator  data.  For  the  BC-135  aircraft,  Rockwell 
estimated  the  POE  error  as  varying  from  wire  to  wire  between  +6  and  +10  dB. 
These  errors  should  be  treated  as  independent  to  arrive  at  the  extrapolation 
error . 
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In  Rockwell's  assessment  method  2  (by  scale-model  aircraft  data),  an 
estimate  of  the  extrapolation  ratio  error  was  not  separated  from  the  POE 
error.  The  net  error  in  predicted  threat  wire  currents  due  to  both  sources 
was  computed  to  lie  between  +7  and  +12  dB,  depending  on  the  orientation  of  the 
aircraft.  This  was  defined  as  "simulation  error"  by  Rockwell. 

Intrasystem  and  Inter  system  Variations.  EMP-induced  wire  currents  occur 
when  switching  from  power-on  to  power-off  operation.  In  addition,  varia¬ 
tions  have  been  observed  in  QiP  couplings  to  the  same  circuits  in  identical 
systems.  Even  within  a  given  system,  variations  in  internal  coupling  occur 
from  day  to  day  because  of  changes  in  physical  layout  and  changes  in  electri¬ 
cal  configuration.  These  variations  have  been  reported  for  aircraft,  but  they 
likely  apply  to  other  systems  as  well.  These  variations  are  strongly  system 
dependent,  and  data  on  them  are  scarce. 

For  the  EC-135,  Rockwell  reports  a  power  on-off  uncertainty  of  +10  dB. 
Morgan^  reports  a  spread  of  20  dB  at  identical  measurement  points  in 
different  samples  of  one  aircraft  type. 

B.  Computer  Simulation.  Computer  simulation  has  been  used  to  make  predic¬ 
tions  for  both  external  and  internal  coupling.  In  terms  of  uncertainty,  how¬ 
ever,  better  results  have  been  achieved  in  external  coupling.  In  the  follow¬ 
ing  discussion,  computer  simulation  predictions  are  compared  to  measured 
values,  and  the  differences  are  attributed  to  prediction  errors.  The  full- 
scale  system  test  errors  discussed  in  the  previous  section  can  produce  a  total 
uncertainty  between  +5  and  +6  dB.*  The  adequacy  of  any  computer  simulation 
technique  should  be  judged  with  these  numbers  in  mind. 

In  external  coupling  cases,  antennas,  cables,  and  external  system 
envelopes  have  received  much  attention.  Antennas  have  been  analyzed  in  free 
space  and  over  ground  (both  lossy  and  perfect)  with  integral  equation 
techniques.  A  review  of  such  simulations  performed  by  Harry  Diamond 
Laboratories  (HDL)  and  LLL  shows  that  peak  response  time-domain  errors  in 


*Measurement  and  data  processing  errors  are  independent  random  variables  and 
are  combined  in  the  usual  fashion  (i.e.,  square  root  of  the  sum  of  squares). 
Instrumentation  errors  are  not  random  and  are  added  linearly. 
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current  should  be  no  higher  than  +4  dB.  Computer  code  predictions  of  aircraft 
surface  current  tend  to  have  error  ranges  scHnewhat  higher  them  this. 

Cable  coupling  studies  have  been  performed  using  transmission  line 
theory.  Cables  over  perfect  and  lossy  grounds  have  been  modeled.  The  largest 
uncertainties  in  specifying  the  parameters  of  the  model  have  been  In  the 
terminating  impedances.  It  appears  that  +3-dB  accuracies  can  be  achieved  in 
predicting  the  EMP-induced  current  entering  a  system  on  a  single  coaxial  or 
multiwire  shielded  transmission  line,  although  in  many  cases  only  +6-dB 
accuracies  have  been  reported.  Skin  currents  and  charges  induced  on  the 
exterior  metallic  envelopes  of  systems  have  been  computed  with  integral 
equations  (i.e.,  wire-mesh  models)  and  finite-difference  schemes.  Objects  in 
free  space  and  over  ground  have  been  considered.  In  particular,  aircraft  have 
been  extensively  analyzed  in  this  fashion.  If  the  modeling  is  done  well, 
uncertainties  can  be  considerably  less  than  +10  dB.  Cases  have  been  reported 
where  errors  of  +3  dB  have  been  obtained  for  aircraft,  using  finite-difference 
codes . 

Interior  coupling  predictions  have  been  made  by  first  computing  the 

currents  and  charges  induced  on  the  exterior  envelope  of  the  system,  as 

described  in  the  previous  paragraph.  These  are  used  to  define  equivalent 

sources  (both  electric  and  magnetic)  on  apertures,  which  in  turn  drive 

internal  cable  systems.  These  attempts  have  been  characterized  by  large 

uncertainties  because  of  the  difficulty  in  modeling  complex  apertures  and 

random-run  multibranch  cables.  In  addition,  it  is  often  not  possible  to 

characterize  precisely  the  load  impedances.  Error  intervals  for  internal 

2 

aircraft  cable  currents,  computed  analytically  by  Rockwell,  using  Bethe 
aperture  penetration  theory  and  circuit  analysis,  have  been  large,  typically 
10  dB  and  more. 

C.  Scale-Model  Tests.  For  several  reasons,  scale-model  tests  have  not  been 
as  popular  in  EMP  coupling  assessment  as  full-scale  system  simulator  tests  and 
analysis.  Chief  among  these  reasons  is  the  difficulty  of  taking  measurements 
in  the  picosecond  time  regime.  Furthermore,  the  scaling  laws  for  nonmetallic 
objects  such  as  dielectrics  with  finite  conductivity  are  nonlinear  in 
frequency,  thus  making  scaling  very  difficult.  Most  reliable  results  are 
achieved  for  metallic  objects,  either  in  free  space  or  over  perfectly 


/ 
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conducting  ground  planes.  Until  recently,  scale-model  tests  have  been  used 
for  making  external  coupling  measurements  only.  Recently,  internal  coupling 
predictions  for  a  ship  have  been  performed  by  LLL,  and  the  predictions  have 
been  compared  to  full-scale  simulator  test  data.  Scale-model  tests  have  been 
used  for  aircraft  predictions  by  the  University  of  Michigan. 

The  scale-model  transient  facilities  are  prone  to  measurement 
uncertainties.  LLL  reports  a  peak  time-domain  uncertainty  in  the  simulator 
field  of  less  than  +1  dB.  Instrumentation  plus  data  processing  errors  are 
estimated  to  be  less  than  +4  dB.  The  University  of  Michigan  test  facility  is 
reported  to  have  a  simulator  field  uncertainty  less  than  +1  dB  at  frequencies 
below  2  GHz  (and  probably  about  the  same  up  to  6  GHz),  with  instrumentation 
errors  less  than  +3  dB  up  to  6  GHz.  Because  scale  models  are  usually  larger 
than  about  1/700  size,  this  frequency  range  scales  to  more  than  8.5  MHz  for 
the  full-size  aircraft.  Data  processing  errors  in  the  Michigan  facility 
typically  appear  to  be  +3  dB,  with  wide  variations  over  the  frequency  band  for 
a  given  scale  model. 

The  University  of  Michigan  model  aircraft  data  contain  an  extrapolation 
error  (called  "simulation  error"  by  Rockwell,  as  mentioned  in  the  preceding 
section)  between  +7  and  +10  dB  for  skin  current  predictions. 

The  comparison  of  LLL  predictions  with  full-scale  simulator  measurements 

4 

by  the  Naval  Surface  Weapons  Center  (NSWC)  for  the  Canadian  ship  Huron 
shows  a  discrepancy  between  +7  dB  and  +10  dB  for  the  antennas  (due  to 
measurement  errors)  and  between  +2  and  +20  dB  for  internal  cables. 

D.  Current  Injection  Tests.  Surface  current  injection  testing  has  been 
performed  on  such  systems  as  aircraft  so  as  to  excite  the  first  one  or  two 
natural  modes  reasonably  accurately,  compared  to  EMP.  But  the  surface  current 
response  has  been  well  matched  over  only  part  of  the  EMP  spectrum.  The  meager 
amount  of  published  data  on  systems  suggests  a  reasonable  and  achievable  error 
of  +6  dB  in  derived  EMP  surface  temporal  response. 

E.  LLL  Modular  Data.  Modular  data  have  been  generated  by  LLL^  for  various 
generic  classes  of  structures,  using  both  computer  models  and  scale-model 
tests.  These  modules  provide  quick-look  external  coupling  estimates  of 
induced  quantities  of  interest,  such  as  current,  voltage,  power,  and  energy. 
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The  data  are  provided  in  parameterized  form  and  can  be  easily  scaled.  Generic 
classes  considered  include  straight  wires  ^uld  loops  in  free  space,  whips  and 
loops  on  boxes,  and  whips  and  loops  on  cylinders.  When  compared  to  actual 
system  test  results,  the  module  prediction  accuracies  ranged  between  1  and 
9  dB.  The  accuracy  is  best  for  structures  that  deviate  little  fran  the  generic 
form  and  worsens  as  the  deviation  increases. 

3.2  SUSCEPTIBILITY 


As  an  element  of  vulnerability  assessment  and  hardening,  subsystem  and 
component  susceptibility  very  rarely  Ccui  be  stated  in  terms  of  the  exact 
environment.  Usually,  susceptibility  is  determined  for  a  class  of 
environments  that  in  some  sense  approximates  the  actual  case.  The 
determination  or  specification  of  the  class  relies  very  strongly  on  the 
interaction  and  coupling  technology.  Typical  classes  of  environments  are 
families  of  exponentially  dsunped  sinusoids  of  current  or  voltage  that  are  used 
to  drive  cables  or  terminals  of  subsystem  units.  Another  common  class  is  a 
set  of  unipolar  pulsed  signals  impressed  on  the  terminals  of  individual 
components . 

Analytical  investigations  of  the  susceptibility  of  both  circuits  and 
ccxnponents  frequently  employ  the  same  classes  of  environmental  signals.  Thus, 
if  susceptibility  depends  strongly  on  the  details  of  an  environment,  large 
systematic  error  is  introduced  into  the  assessment.  Such  errors  might  not  be 
recognized  until  a  system  test  is  performed.  Clearly,  the  susceptibility  of  a 
subsystem  or  circuit  depends  on  the  interior  configuration,  thus  errors  are 
introduced  by  assumptions  concerning  this  configuration. 

3.2.1  Subsystem  Assessment 

Subsystem  assessment  work  may  be  faced  with  different  uncertainties, 
depending  on  the  requirements.  There  is  no  standard  practice  in  subsystems 
work.  Instead,  there  are  at  least  three  different  ways  of  approaching  the 
problem: 

•  Assessment  relative  to  a  specification  placed  on  the  interface  of  the 
subsystem.  (For  example,  the  B-1  Aircraft  or  Advanced  Airborne  Command  Post 
Pin  Specification.) 


11 


•  Assessment  that  uses  a  replica  or  an  extrapolation  of  the  actual 
signal  present  in  the  system  (as  might  be  obtained  from  tests  on  a  missile 
system) . 

•  Assessment  that  uses  a  "representation,”  because  the  number  of 
subsystems  is  so  large  that  it  precludes  detailed  analysis  or  investigation  of 
all  of  them.  This  approach  could  introduce  much  judgmental  uncertainty,  as 
well  as  systematic  errors. 

A.  Uncertainties  in  Methodology  Development.  By  definition,  a  methodology 

should  be  a  precise  and  orderly  procedure.  In  practice,  it  could  be  a  highly 

adaptive  and  ad  hoc  procedure,  designed  to  fit  the  situation  (e.g.,  to 

eliminate  or  add  tests) .  The  compromises  made  in  developing  a  methodology  for 

a  particular  program  are  usually  recognized,  but  their  full  significance  in 

terms  of  the  errors  they  generate  may  not  be  realized.  Each  methodology 

places  emphasis  on  those  phases  of  activity  that  are  important  to  the  project 

at  hand.  For  example,  a  decision  not  to  do  any  testing  because  of  costs  or 

other  reasons  would  create  a  different  set  of  uncertainties  than  if  both  tests 

and  analyses  were  performed.  The  Advanced  Airborne  Command  Post  (AABNCP) 

5,6 

Assessment  Program  is  an  example  of  a  strong  methodology,  heavily  based 

on  existing  data,  but  backed  up  with  tests  on  selected  subsystems  for  the 

verification  of  predicted  failure  levels.  Chapter  13  of  the  DNA  BMP 
7 

Handbook  includes  a  generic  approach  to  assessment  and  lists  some  of  the 
issues  involved. 

B.  Uncertainties  in  Analysis.  In  subsystems  susceptibility  work,  analysis 
can  mean  doing  a  simple  screening  of  susceptible  ccxnponents  on  a  penetration 
interface,  or  it  can  mean  performing  a  detailed  circuit  analysis  from  the 
interface  through  several  critical  components. 

Uncertainties  in  analysis  arise  from  the  lack  of  suitable 
large-signal-level  models  for  components,  the  lack  of  information  on  circuit 
and  device  parameters,  and  a  general  inability  to  handle  very  large  problems. 
Engineering  judgment  is  used  to  simplify  the  circuit  for  analysis,  and  the 
errors  are  not  always  evaluated  by  experiment. 
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C.  Uncertainties  in  Testing.  One  of  the  largest  uncertainties  in  testing  may 
result  from  not  being  able  to  inject  signals  to  all  circuit  terminals 
simultaneously.  This  is  a  good  argument  for  doing  a  systems  test  at  one  point 
in  the  development  cycle  of  the  system.  Ground  loops  and  other  problems 
unique  to  the  type  of  interconnection  may  not  show  up  in  subsystem  or  unit 
tests. 

Another  uncertainty  arises  in  the  simulation  of  the  actual  interface  EMP 
signal.  It  is  of  interest  to  compare  the  set  of  test  signals  and  their  effect 
on  the  subsystem  or  unit  with  a  set  of  possible  EMP  signals.  The  executive 
summary  report^  of  the  AABNCP  program  contains  information  on  the  relative 
accuracy  of  subsystem  assessment  analysis  c<^pared  to  certain  test  results. 

The  results  show  that  the  analysis  was  generally  conservative,  with  a  range  of 
0.35  to  744  for  ratios  of  failure  current  (test)  to  failure  current  (analysis). 

D.  Uncertainties  in  Data  Handling.  The  handling  and  processing  of  data  in 
the  bandwidths  and  quantities  required  for  EMP  assessments  appear  to  cause 
concern  more  for  economic  reasons  than  for  the  errors  and  uncertainties 
generated.  Reference  6  discusses  the  handling  of  subsystem  functional 
description  data. 

E.  Uncertainties  in  Configuration.  A  specification  may  or  may  not  be  closely 
tied  to  the  actual  operating  environment  from  EMP-induced  signals. 

Uncertainty  arises  from  the  use  of  an  interface  specification  that  permits 
subsystems  design  or  assessment  to  conform  to  a  uniform  criterion.  Regardless 
of  the  specification,  however,  a  major  uncertainty  in  the  analysis  of 
subsystems  results  from  assuming  the  basic  configuration  of  the  subsystem. 

Such  an  uncertainty  can  not  be  easily  resolved  and  can  therefore  cause  large 
errors  in  assessment.  An  example  is  the  assumption  of  no  direct  conduction 
path,  where  in  fact  there  is  one.  Circuit  analysis  by  computer  plays  a 
significant  role  in  subsystem  assessment,  and  it  relies  heavily  on  suitable 
determinations  of  configuration. 

3.2.2  C<xnponents  Assessment 

There  has  been  much  investigation  of  the  physics  of  failure,  of  various 
failure  modes,  and  of  thresholds  for  many  different  devices.  Given  the  large 
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number  of  devices,  however,  particularly  the  more  susceptible  solid-state 
components,  it  is  rare  that  a  single  device  can  be  controlled  and  studied  in 
detail.  Instead,  through  use  of  small  samples,  attempts  have  been  made  to 
derive  general  models  that  can  be  used  with  prediction  techniques.  Such 
models  include  the  familicu:  power  dissipation  formula  for  a  semiconductor 
junction; 

— k 

P  =  kt  ^  , 

where  P  is  the  failure  power,  t  is  the  pulse  width  (duration),  and  k  is  a 
constant.  An  empirical  extension  to  the  case  of  integrated  circuits  has  the 
form 

P  =  At”®  , 

where  A  and  B  are  empirically  determined  constants. 

Uncertainties  have  several  sources; 

•  Use  of  theoretical  models  for  damage  prediction. 

•  Waveform  differences  between  the  actual  system  and  the  component  test. 

•  Ranges  of  distribution  of  failure  parameters. 

•  Definitions  of  integrated-circuit  damage. 

Theoretical  models  must  resort  to  published  data  on  device  parameters, 
usually  based  on  junction  capacitance.  Waveform  differences  are  significant 
when  a  device  exhibits  a  lower  failure  level  for  one  polarity  than  the  other, 
or  when  the  failure  level  is  affected  by  repeated  pulses  of  varying  polarity. 
Testing,  however,  is  usually  performed  with  step-stressing  at  one  polarity. 
Sometimes  it  is  actually  quite  difficult  to  determine  when  an  integrated 
circuit  has  failed.  Degradation  of  certain  device  parcuneters  is  possible 
without  catastrophic  failure. 

A.  Experimental  Uncertainties  in  Component  Testing. 

Environment  Simulation.  Very  little  testing  of  components  is  performed 
with  a  simulation  of  the  actual  in-place  or  in-circuit  environment.  For 
reasons  of  economy  and  ease  of  generation,  testing  is  done  primarily  with  a 
unipolar  pulse  waveform.  A  high  degree  of  automation  is  employed  in  testing. 
Actual  environment  waveforms  (as  observed  from  system  EMP  simulation  tests) 
are  nearly  always  some  variation  of  a  damped  sinusoid,  with  a  frequency 
content  that  depends  on  the  system  configuration. 
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Instrumentation.  Sensing  of  voltage  and  current  is  not  a  major  source  of 
uncertainty.  Step-stressing  is  commonly  used,  so  large  errors  are  unlikely. 
However,  determination  of  exact  time  of  failure  can  be  a  source  of  error. 
Pretest  instrumentation  normally  involves  an  autcxnated  parameter-measuring 
test  set;  posttest  determination  of  possibly  degraded  parameters  can  then  be 
evaluated  by  the  same  test  set,  thereby  removing  an  uncertainty  through 
standardizing.  Absolute  errors  or  uncertainties  in  component  use  for  a 
particular  application,  however,  are  only  as  good  as  the  completeness  of 
coverage  of  the  original  parameter  test  set.  Measurement  and  digitizer  errors 
have  been  shown  to  be  less  than  25%  for  worst  cases  and  less  than  10%  for  rms 
variations.  Test  methodology  and  error  analysis  are  discussed  in  Appendices  A 
and  B  of  Ref.  8. 

B.  Uncertainties  in  Analysis.  Chapter  13  on  "Canponent  BMP  Sensitivity  and 
System  Upset"  of  the  DNA  BMP  Handbook^  also  contains  some  general 
information  on  uncertainties  or  accuracy  factors  of  variables  as  used  in 
analysis.  The  three  phases  of  damage  analysis  methodology  are  data 
acquisition,  detailed  theoretical  analysis,  and  susceptibility  screen 
development. 

Data  Acquisition.  The  detail  and  quality  of  data  on  subsystem,  circuits, 
and  components  available  for  analysis  vary  considerably.  It  is  often 
necessary  to  infer  circuit  parameters  from  schematics,  and  some  circuit 
details  may  not  be  available.  The  availability  and  accuracy  of  failure 
parameters  for  devices  is  one  of  the  most  significant  constraints  in 
performing  an  BMP  assessment.  Some  methods  for  obtaining  ccxnponent  failure 
parameters,  in  addition  to  doing  actual  testing,  are  the  use  of  data  with  the 
AFWL's  code  SUPBRSAP,  the  use  of  existing  equations  (supplemented  by 
measurement),  the  use  of  equations  and  certain  published  data,  and  the 
estimation  of  damage  thresholds  in  various  general  categories  of  devices. 
Threshold  values  can  easily  vary  tenfold. 
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Detailed  Theoretical  Analysis.  Detailed  theoretical  analysis  at  the 
circuit  level  requires  several  types  of  information  and  tools,  each  of  which 
can  involve  a  Icurge  amount  of  uncertainty. 

The  principal  tools  for  complex  circuits  ^u:e  the  large,  general-purpose 
circuit  and  system  codes,  such  as  CIRCUS,  NET-2,  SCEPTRE,  etc.  Complete 
circuit  simulation  is  possible  in  principle,  but  may  be  prohibitively  costly. 
Much  smaller  codes,  such  as  HANAP2,  are  also  used.  A  simplification  of  the 
circuit  to  reduce  the  complexity  could  omit  important  responses.  A 
preliminary  analysis  by  an  engineer  familiar  with  the  design  of  the  circuit 
will  conveniently  eliminate  certain  sections  or  components,  but  there  is 
uncertainty  in  accounting  for  the  possibility  of  damaging  a  "buried"  circuit 
component,  with  no  apparent  direct  connection  to  the  circuit  of  concern. 
Judgmental  errors  will  arise  in  the  simplification  of  circuits  for  analysis. 

Screening  for  Susceptibility.  Screening  of  subsystems  or  components  for 
hardness  uses  some  method  of  ranking  components  for  inherent  hardness.  This 
can  be  quite  simple,  involving  little  uncertainty,  such  as  screening  out  all 
semiconductor  circuits  as  being  inherently  soft.  A  more  sophisticated  screen 
uses  values  of  failure  threshold  parameters  for  devices,  such  as  a  K  (Wunsch 
constant)  value.  Lack  of  proper  data  concerning  a  circuit  description  can 
cause  a  great  amount  of  uncertainty  in  all  cases..  For  instance,  an  assumption 
that  a  circuit  is  not  a  solid-state  one,  when  in  fact  it  must  be  to  function 
properly,  would  create  serious  susceptibility  uncertainties  regardless  of  the 
method  of  screening  used. 


A. 


Circuits  and  Subsystems.  Sources  of  uncertainty  include: 

•  Circuit  parameters,  specific  devices/circuits. 

•  Transformer  coil  nonlinear  effects. 

•  High-level  solid-state  device  models/response. 

•  Indirect  coupling  to  "buried"  circuits. 

•  Simultaneous  pin-  or  port-excitation  effects. 

•  Power-on  vs  power-off  effects. 

•  Function  definitions. 

•  Stray  element  effects. 


It  would  be  very  difficult  in  general  to  quantify  the  errors  associated 
with  each  item  on  the  above  list.  Many  of  these  uncertainties  depend  on  the 
level  of  detail  available  for  the  subsystem  or  circuit  being  assessed. 
Correlations  of  predicted  subsystem  unit  failure  thresholds  with  test  results 
indicate  that  analysis  techniques  have  been  generally  conservative.^  Some 
of  these  results  are  sunmarized  in  Table  3.1.  The  values  represent  ratios  of 
box-pin-test  failure  {current  and  voltage)  thresholds  (subscript  P)  to 
analytically  predicted  thresholds  (subscript  T)  for  fifteen  electronics  units 
from  eight  different  subsystems.  The  posttest  comparisons  include  some 
modifications  in  the  analysis,  such  as  component  test  results,  revised 
information  on  components  values,  circuits  topology,  etc.,  which  were  absent 
in  the  pretest  predictions. 

In  both  the  AABNCP  and  EC-135  assessment  programs,  box-pin  tests  were 
performed  for  several  boxes.  The  more  recent  EC-135  progreun  included  a 
summary  of  box-level  data  points  for  both  assessment  programs,  shown  in 
Table  3.2. 

The  EC-135  prediction  data  include  the  effects  of  semiconductor  junction 
bulk  resistance,  while  the  AABNCP  data  do  not.  The  data  from  the  tables 
suggest  that  the  calculated  thresholds  provide  a  reliable  lower  bound  for 
subsystem  boxes. 

B.  Components.  Sources  of  uncertainty  include: 

•  Damage  prediction  with  theoretical  models. 

•  Waveform  differences  between  the  actual  system  and  the  component  test. 

•  Distribution  of  thresholds. 

•  Definitions  of  integrated-circuit  damage. 

•  Unexpected  failure  modes. 

•  Lot-to-lot,  manufacturer-to-manufacturer  variations. 

•  Effect  of  lead  inductances  in  testing. 

•  Unipolar  step-stressing  quantization  error. 

There  is  much  quantitative  information  on  component  device  threshold 
variability.  Chapter  13  of  the  DNA  BMP  Handbook^  contains  information  on 
the  relative  damage  susceptibility  of  electronic  components.  (The  threshold 
ranges  for  the  different  general  classes  of  components  are  shown  in  Fig.  3.1.) 
The  handbook  also  presents  estimated  values  for  K,  the  damage  constant,  for 
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TABLE  3.1.  Comparison  of  tested  failure  threshold  (F)  to  theoretical 
thresholds  (T)  for  subsystem  electronic  boxes  (Ref.  5). 


Box 

nuniber 

Posttest  (rev 

ised)  oonpar 

Isons 

Pretest 

oompar Isons 

VIt 

V^'t 

V^T 

Min 

Max 

Min 

Max 

Min 

Max 

Min 

Max 

1 

7.88 

8 

1.2 

8 

2 

0.64 

156 

0.92 

258 

0.64 

156 

0.6 

258 

3 

6.7 

8.1 

8.1 

8.6 

6.7 

8.1 

8.1 

8.6 

4 

0.5 

3 

5 

17 

0.5 

2.4 

1.1 

9.6 

5 

0.7 

>12 

>0.3 

>0.6 

0.7 

>12 

>0.3 

7.6 

6 

1.9 

7.5 

1.3 

3.7 

1.9 

3.1 

0.56 

1.6 

7 

1.7 

12 

1.3 

4.0 

0.35 

9 

0.17 

2.5 

8 

78.9 

744 

71.1 

>1.5 

9 

1.5 

11.3 

2.0 

3.7 

0.7 

5.1 

4.5 

25 

10 

1.9 

4.2 

1.3 

2.8 

2.4 

9.8 

1.3 

10.7 

11 

1.2 

1.5 

0.44 

0.68 

0.69 

8.5 

0.07 

3.8 

12 

No  burnout  noted 

— transmissibility  assumptions 

verified 

13 

No  burnout  thresholds  noted- 

-arc-over 

predictions  verified 

14 

3.7 

37 

3 

9 

8 

22 

1.8 

11 

15 

1.17 

10.1 

2.02 

10.1 

1.17 

10.1 

2.02 

10.1 

TABLE  3.2. 

Summary  of  box-level  data  points 

for  two  assessment  programs  (Ref.  2) 

Number 

of  data  points 

No.  of 

Test 

Test 

Total 

boxes 

Burnouts  > 

Burnouts  < 

stoppec  > 

stoppec  < 

data 

Program 

tested 

predicted 

predicted 

prediction 

prediction 

points 

EC- 13  5 

9 

8 

0 

71 

27 

106 

assessment 

AABNCP  GFE 

15 

39 

1 

65 

total 

105 

assessment 

different  device  categories.  The  information  includes  K  ,  with  upper  and 

lower  95%  confidence  limits,  for  several  types  of  diodes  and  transistors.  The 

sample  size  for  each  type  varies  from  2  to  56.  Nearly  all  limits  are  a  factor 

of  10  (or  more)  above  or  below  the  K  values.  There  is  also  a  summary  of 

mean 

integrated-circuit  threshold  variations  by  category.  Limits  are  given  for  the 

parameter  A,  in  the  failure  model  P  =  At  ,  for  the  TTL,  RTL,  DTL,  BCL,  MOS, 

and  LINEAR  families  of  devices.  These  limits  range  from  a  factor  of  2.1  to  13 

above  or  below  the  A_  values.  Such  variation  will  produce  variations  in 

mean 

burnout  power  (l-ys  pulse  width)  of  5  to  200  W  for  all  families,  and  limits 
as  high  as  6  to  1100  W  for  one  family  (LINEAR) . 

Data  are  also  available  that  compare  transistor  and  diode  test  results 
with  predicted  damage  constants  (K  factors).  For  example,  the  data  in  Table  3.3 
illustrate  the  range  of  ratios  of  test  K  factors  to  predicted  K  factors  for  the 
junction  capacity  prediction  model.  The  other  models  (thermal  resistance)  have 
greater  variation.  Diodes  show  a  greater  range  of  uncertainty,  but  the  sample 
size  was  small. 

Separate  models  for  classes  of  devices  have  also  been  developed  and 

9 

studied  at  General  Electric  Co.  One  report  discusses  damage  models 
developed  for  classes  of  diodes  and  uses  the  existing  experimental  data  base 
for  input.  Models  are  presented  in  the  form  of  equations  that  include  certain 
device  parameters  (such  as  breakdown  voltages  at  low  level) ,  and  that  also 
provide  a  factors  as  multipliers.  The  value  of  a  for  Ip^^  (reverse  current 
damage)  is  1.58  for  a  1N4148  diode;  2.51  for  rectifiers,  diodes,  and  switches; 
and  2.14  for  zener  diodes.  In  a  second  report, 252  integrated  circuits  of 


TABLE  3.3  Comparisons  of  test  K  factors  to  predicted  K  factors  for  transistors 
and  diodes,  using  the  junction  capacity  model. 


Transistors 

Collector-base 

Base-emitter 

Diodes 

Measured 

(16 

samples) 

(16  samples) 

(6  samples) 

parameter 

Min 

Max  Range 

Min  Max  Range 

Min  Max  Range 

Power 

0.78 

19 

24 

0.16 

9.2 

58 

0.014 

1.7 

121 

Current 

0.35 

23 

66 

0.05 

2.1 

42 

0.010 

1.0 

100 
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several  types  were  tested  and  modeled,  with  confidence  limits  as  a 

multipliers  included.  There  are  models  for  RTL,  DTL,  TTL  (several  types), 

ECL,  and  LINEAR  circuits.  Sigma  factors  range  from  1.4  to  4.8  for  models  of 
-B 

the  form  P  =  At  .  References  9  and  10  should  be  consulted  for  the 
appropriate  model  to  be  used  with  each  class  of  device  and  for  each  input 
terminal. 


4.0  COMPARISON  OF  VULNERABILITY  ASSESSMENT  TECHNIQUES 

An  assessment  technique,  whether  based  on  simulated  or  full-scale 
testing,  system  modeling,  or  analysis,  is  likely  to  vary  with  each  problem, 
depending  on  the  circumstances  of  the  assessment.  Several  factors  which 
affect  the  choice  of  methodology  are: 

•  State  of  system  developnent:  is  it  a  new  system,  deployed  system, 
upgraded  or  revised  system,  etc.? 

•  Level  of  knowledge  of  the  threat  or  of  the  system  and/or  the 
components:  to  what  extent  is  the  environment  known,  to  what  extent  is  the 
system  coupling  known,  what  is  known  about  component  susceptibility? 

•  Availability  of  resources:  what  funding,  expertise,  or  time  is 
available  for  the  assessment? 

•  Other  constraints:  is  the  system  available  for  testing,  etc.? 

These  and  other  factors  influence  not  only  the  choice  of  overall  methodology, 
but  also  the  particular  techniques  used  within  the  framework  of  the  overall 
method. 

Whatever  the  methodology  considered,  it  is  important  that  the  technique 
accommodate  the  many  uncertainties  that  may  affect  the  assessment  results. 
Again,  it  is  expected  that  uncertainties  be  handled  differently  in  different 
methodologies.  Also,  the  extent  to  which  uncertainties  enter  into  the 
analysis  will  change  from  situation  to  situation.  Certainly,  the  availability 
of  information  regarding  the  uncertainties  in  the  assessment  parameters  will 
determine  how  extensive  an  analysis  of  uncertainties  is  performed. 

The  following  paragraphs  outline  briefly  some  of  the  methods  used  in 
vulnerability  assessments  of  large  systems.  They  are  followed  by  a 
description  and  discussion  of  how  uncertainties  are  handled  within  the  method. 
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4.1  HDL  ASSESSMENT  METHODOLOGY 


One  assessment  technique  is  exemplified  by  the  methodology  developed  and 
used  by  HDL  in  the  Multiple  Systems  Evaluation  Program  (MSEP).^^  This 
technique  makes  heavy  use  of  analytically  oriented  coupling  and  circuit-code 
models.  Test  data  on  system  components  and  system  coupling  are  used  both  for 
developing  the  computer  models  and  as  a  source  of  inputs  to  the  system 
assessment.  Uncertainties  are  included  at  all  stages  of  the  analysis.  They 
include  uncertainties  in  the  system  model,  uncertainties  in  ccxnponent 
susceptibility,  uncertainties  in  component  responses  due  to  modeling,  etc. 
These  uncertainties  are  not  probabilistically  stated,  but  are  used  for 
detailed  modeling  and  calculations  to  obtain  a  worst-case  assessment. 

4.2  ROCKWELL  ASSESSMENT  METHODOLOGY 


An  alternative  assessment  method  was  applied  by  Rockwell  International  to 

2 

an  assessment  of  the  EC-135  aircraft.  This  method  is  based  on  measurements 
of  the  transient  currents  and  voltages  in  the  aircraft  while  it  is  in  a 
simulated  environment.  These  currents  and  voltages  were  analytically 
extrapolated  to  threat  level,  and  the  dB  difference  between  a  component  threat 
current  and  its  susceptibility  was  defined  as  a  "hardness  margin"  for  that 
component.  The  extrapolation  of  test  data  to  criterion  level  was  based  on 
extrapolation  functions  determined  either  from  mathematical  models  or  from 
scale-model  tests.  Uncertainties  in  the  test  measurements,  susceptibility 
data,  and  extrapolation  functions  were  described  probabilistically  and  were 
propagated  throughout  the  analysis,  using  the  methods  of  statistical  error 
propagation.  The  final  assessment  results  were  stated  as  a 
reliability-confidence  interval. 

4.3  BOEING  ASSESSMENT  METHODOLOGY 


The  Boeing  Aerospace  Corporation  has  developed  assessment  methods  to 

predict  the  communication  impairment  of  communication  facilities  in  a  threat 
12  13 

environment.  '  The  method  employs  both  electrical  and  functional 
models.  The  former  is  used  to  determine  the  input  at  critical  components 
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throughout  the  system.  This  in  turn  is  compared  to  the  component  failure 
threshold  to  determine  a  probability  of  disruption.  These  probabilities  are 
then  applied  to  the  functional  model  to  determine  a  probability  of 
communication  impairment.  Uncertainties  in  inputs,  component  and  system 
parameters,  etc.,  are  introduced  using  the  concept  of  "data  quality." 

4.4  TRW  WORK 

In  other  work,  TRW^^  studied  the  general  problem  of  methodologies  for 
vulnerability  assessment,  specifically  as  applied  to  aircraft.  Its  study 
suggested  that  all  assessment  concept  alternatives  could  be  obtained  by 
answering  the  following  seven  basic  questions; 

1.  What  survivability  statements  constitute  an  answer  in  the  assessment? 

2.  What  is  the  basis  for  establishing  these  survival  statements? 

3.  What  is  the  threshold  concept?  (How  is  it  characterized  and  referenced?) 

4.  What  is  the  extrapolation  concept?  (How  is  coupling  to  the  threshold 
point  determined?) 

5.  What  is  the  final  assessment  analysis  concept?  (What  is  the  technical 
basis  for  data  analysis?) 

6.  What  is  the  simulation  philosophy? 

7.  What  is  the  test  object  configuration  philosophy? 

TRW  proceeds  in  the  study  to  enumerate  eleven  assessment  concepts  that 
include  three  possible  threshold  reference  locations  and  four  possible 
extrapolation  concept  alternatives: 

Threshold  references 

Tl.  Pressure  hull  interface. 

T2.  Pressure  hull  (damage),  subsystem  box  interface  (upset). 

T3.  Subsystem  box  interface. 

Extrapolation  concept 
El.  Analytical  model. 

E2.  Hybrid  analytical  model. 
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E3.  Direct  extrapolation  of  system  test  data  by  scalar  multiplier. 

E4.  Threat- level  direct  drive  on  portions  of  the  system,  based  on  subthreat 

excitation  of  total  system. 

Only  the  combination  of  T3  and  El  was  considered  not  viable  due  to 
state-of-the-art  limitations  in  internal  coupling  analyses.  The  purpose  of 
this  phase  of  the  study  was  to  develop  the  concepts  and  to  identify  data  and 
technology  needed  to  implement  these  concepts.  TRW  did  not  choose  an  optimum 
candidate  concept. 

One  method  based  on  the  concepts  outlined  by  TRW  is  a  probabilistic 
analysis  that  makes  extensive  use  of  simulation  to  assess  system 
survivability.  One  version  of  the  probabilistic  analysis,  as  applied  by  LLL 
to  two  simple  systems,  is  described  in  Section  5.  With  regard  to 
uncertainties,  the  probabilistic  analysis  distinguishes  between  random  and 
systematic  uncertainties  in  all  assessment  variables.  For  any  fixed 
systematic  error,  the  effect  of  random  variations  on  the  value  of  the 
probability  of  survival  is  assessed  by  Monte  Carlo  methods.  The  result  is  an 
estimate  of  the  probability  of  survival.  By  varying  the  systematic  error,  a 
distribution  of  estimates  can  be  generated.  In  turn,  a  confidence  interval 
(or  confidence  bound)  can  be  evaluated  from  this  distribution.  The  final 
result  is  an  estimate  of  the  probability  of  survival,  stated  with  a  measure  of 
confidence.  This  method  relies  heavily  on  computer  modeling,  both  in  terms  of 
the  inputs  (threat,  system  parameters,  system  operation,  etc.)  and  the 
uncertainties  (random  and  systematic) .  Thus,  TRW  has  developed  several 
computer  codes^^'^^'^®  (e.g.,  SANE,  SURVIVE,  FAST)  to  perform  this  type  of 
analysis.  Many  simplifying  assumptions  have  been  made  in  developing  these 
codes,  hence  the  applicability  of  such  codes  to  vulnerability  assessment  is 
questionable.  One  of  the  purposes  of  the  LLL  study  was  to  determine  whether  a 
probabilistic  analysis,  based  on  a  computer  model  (FAST),  would  generate 
estimates  that  could  be  verified  by  laboratory  experiments  for  simple 
systems.  TRW  has  recently  applied  this  type  of  methodology  to  assess  the 
survivability  of  a  radio  system  when  subject  to  the  EMP  of  a  high-altitude 
burst. 
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4.5  DISCUSSION 


All  of  the  methodologies  outlined  above  consider  uncertainties  in  the 
assessment  variables,  but  the  degree  to  which  these  uncertainties  affect  the 
analysis  and  the  types  of  results  differs  considerably  among  methods.  The  HDL 
approach  to  uncertainties  is,  perhaps,  the  least  sophisticated.  The  quantity 
of  real  interest  in  this  approach  is  the  largest  value  of  the  uncertainty. 

This  is  used  in  the  worst-case  analysis  to  evaluate  the  worst-case  margin  of 
safety.  This  leads  to  a  conservative  assessment.  This  type  of  assessment 
indicates  the  vulnerability  in  an  extreme  situation;  it  fails  to  recognize 
that  such  a  situation  occurs  with  a  very  low  probability.  Also,  no  matter 
what  value  is  used  for  the  largest  uncertainty,  it  is  likely  that  this  is  not 
an  absolute  upper  bound.  Instead,  it  is  likely  to  be  a  value  that  will  not  be 
exceeded  with  high  probability.  Thus,  the  HDL  approach  may  not  in  fact 
produce  a  worst-case  analysis.  The  methodologies  used  by  Rockwell  and  Boeing, 
and  suggested  by  TRW,  treat  uncertainties  as  probabilistic  quantities:  the 
values  of  the  uncertainties  are  assumed  to  be  described  by  a  probability 
distribution.  Boeing  introduces  uncertainties  in  the  assessment  variables 
through  a  factor  called  "data  quality"  (DQ) .  It  is  assumed  that  the 
uncertainty  in  the  safety  margin  (the  logarithm  of  the  ratio  of  the  failure 
threshold  signal  to  the  response  signal)  is  due  to  one  of  three  types  of 
variation: 

1.  Random  variation  among  similar  units,  which  assumes  that  the  "true" 
population  safety  margin  is  known. 

2.  Systematic  variation  in  the  safety  margin  of  the  specific  unit  being 
tested. 

3.  Systematic  plus  random  variation  in  the  observed  safety  margin. 

The  distribution  in  the  safety  margin,  as  described  by  DQ,  is  used  to 
evaluate  the  probability  of  unit  survival  in  case  1  or  to  evaluate  the 
"confidence"  that  the  unit  survive  in  cases  2  and  3.  These  probabilities  (or 
confidences)  are  combined  to  evaluate  the  corresponding  measure  of  system 
survivability.  The  initial  analyses  done  by  Boeing  assumed  that  the 
distributional  parameters  are  known.  Later  work^^  extended  the  methodology 
to  include  situations  in  which  the  parameters  are  estimated  from  sample  data 
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("extended  data  quality")  and/or  mathematical  modeling  is  used  to  predict  the 
inputs  into  the  vulnerability  assessment  ("model  prediction  coefficient"). 

This  method  of  acccxnmodating  uncertainties,  as  used  by  Boeing,  relies  on 
a  single  measure  to  describe  uncertainty,  whether  it  is  random  or  systematic. 
Thus,  the  effect  of  these  uncertainties  cannot  be  separated  in  sensitivity 
analyses.  Also,  in  extending  the  methodology  to  include  mathematical  modeling 
uncertainties  and  parameter  estimation  uncertainties,  a  simplifying  assumption 
of  Gaussian  variation  was  made.  This  restricts  the  applicability  of  the 
method.  Further,  the  use  of  the  term  "confidence"  is  specialized  and  could 
lead  to  confusion  with  the  more  common  meaning  of  the  term. 

Rockwell  uses  a  reliability-confidence  interval  as  a  measure  of 
uncertainty  in  a  variable.  We  define  it  as  follows: 

A  3  100%  -  Y  100%  reliability-confidence  interval  for 

a  variable  I,  given  by  ±AI,  means  that  based  on  test 

data,  if  I  is  the  "nominal"  value  of  I,  then  one  is 
o 

Y  100%  confident  that  at  least  3  100%  of  the  values  of 

I  within  the  appropriate  population  will  be  in  the 

interval  (I  -  AI,  I  +  AI) 
o  o 

Thus,  reliability-confidence  intervals  are  statements  of  bounds  between 
which  a  stated  percentage  of  values  of  a  variable  can  be  expected  to  lie.  The 
"quality"  of  the  methods  used  to  determine  these  bounds  are  expressed  by  the 
confidence  statement.  In  contrast  with  Boeing's  use  of  the  term  "confidence," 
the  usage  here  is  consistent  with  that  usually  found  in  the  statistical 
literature.  On  the  other  hand,  Rockwell's  use  of  the  term  "reliability" 
differs  from  the  use  of  the  term  in  reliability  theory.  As  used  by  Rockwell, 
it  is  a  measure  of  the  concentration  of  the  values  of  a  variable  around  the 
nominal  value. 

Reliability-confidence  intervals  for  all  input  variables  are  assumed 
inputs  to  the  assessment  analysis.  These  variables  (and  intervals)  are 
analytically  combined  to  evaluate  the  safety  margin  (and  interval)  for 
individual  con^onents.  These  are  ultimately  combined  for  a  system  safety 
margin  determination.  The  final  output  is  an  estimated  lower  bound  for  the 
probability  that  the  system  safety  margin  is  greater  than  zero,  where  the 
estimate  is  given  with  a  specified  level  of  confidence.  One  major  problem 
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with  the  approach  used  by  Rockwell  in  accommodating  uncertainties  is  the 
method  used  for  combining  uncertainties.  Two  types  of  reliability-confidence 
intervals  are  developed,  one  assuming  Gaussian  variables  2md  the  other  a 
nonparametric  interval.  Interval  half-widths  (errors)  are  combined  as  the 
square  root  of  the  sum  of  squares,  even  when  a  Gaussian  variable  is  combined 
with  a  non-Gaussian  variable.  There  is  some  question  about  the  resulting 
confidence  interval.  (This  same  question  exists  even  when  combining  the  same 
types  of  intervals.)  Also,  Rockwell  does  not  separate  the  effects  of 
systematic  and  random  uncertainties,  but  combines  them  into  a  single  measure. 

5.0  A  METHODOLOGY  BASED  ON  PROBABILISTIC  ANALYSIS 

As  indicated  in  the  discussion  of  alternative  vulnerability  assessment 
methodologies,  any  realistic  assessment  must  take  into  consideration  the 
uncertainties  in  the  assessment  variables.  A  method  based  on  a  worst-case 
assessment,  though  it  may  be  practical,  is  not  realistic,  since  it  deals  with 
a  situation  that  generally  has  a  very  low  probability  of  occurring.  The  more 
realistic  approach  is  to  recognize  the  variation  in  the  uncertainties.  A 
convenient  method  for  describing  this  variation  is  a  probability  distribution. 
Thus,  the  tools  of  probability  should  be  used  in  the  assessment  methodology. 
Two  of  the  methods  described  in  Section  4  use  probability  to  handle 
uncertainties,  but  they  inadequately  separate  the  effects  of  random  and 
systematic  uncertainties,  and  their  methods  for  combining  uncertainties  in 
several  variables  are  suspect. 

A  methodology  that  recognizes  the  variation  in  variable  uncertainties  and 
that  does  not  have  the  deficiencies  mentioned  above  is  based  on  the  use  of 
Monte  Carlo  methods  to  analyze  the  effect  of  uncertainties  in  the  assessment 
variables.  A  flow  diagram  illustrating  such  an  approach  is  given  in  Fig.  5.1. 
This  approach  relies  heavily  on  computer  models  to  describe  the  coupling 
(both  exterior  and  interior)  for  a  system.  Inputs  are  assumed  to  be 
environmental  data  (e.g.,  EMP  electric  field  data  generated  by  BMP  codes), 
coupling  models  with  appropriate  system  parameter  values,  component 
susceptibility  data  (perhaps  developed  from  test  data),  and  finally,  a  system 
model  consistent  with  the  assessment  goal.  Thus,  the  system  model  may  depend 


FIG.  5.1.  Elements  of  a  probabilistic  approach  for  handling  uncertainties. 


on  whether  the  aim  is  to  assess  vulnerability,  hardening,  or  survivability 
(the  ability  to  complete  a  specified  mission  when  subject  to  a  given  threat). 
Additional  important  inputs  are  the  probability  distributions  that  describe 
the  variation  in  the  uncertainties  associated  with  each  of  the  assessment 
variables.  Separate  distributions  are  used  for  each  type  of  uncertainty 
(random,  systematic,  and  judgmental). 

For  fixed  values  of  each  systematic  (or  judgmental)  uncertainty,  chosen  at 
random  frcxn  the  distribution  of  such  uncertainty,  the  environment  confronting 
a  system  is  simulated  by  randomly  selecting  a  random  uncertainty  for  the 
environmental  variable.  In  propagating  the  environmental  variable  through  the 
coupling  model,  the  tools  of  reliability  theory  are  used  to  determine  the 
probability  of  the  component  surviving  by  comparing  the  input  to  the  component 
with  the  component  failure  threshold.  The  survival  probabilities  for  all  the 
system  components  are  then  combined,  using  the  system  model,  to  determine  the 
probability  of  system  survival.  Iterating  through  this  procedure  and 


averaging  all  the  probabilities  provides  an  estimate  of  the  expected 
probability  of  survival  (or  failure)  for  the  given  systematic  (or  judgmental) 
uncertainty.  This  is  em  estimate  of  the  probability  that  the  system  will 
survive  when  confronted  by  a  threat. 

This  procedure  is  repeated  for  additional  values  of  the  systematic  (or 
judgmental)  uncertainties,  and  thus  a  distribution  of  values  of  the  estimated 
probability  of  survival  is  generated.  The  average  value,  taken  frcan  this 
distribution,  is  the  point  estimate  of  the  probability  of  survival  for  the 
system.  This  average  is  taken  over  all  possible  variations  of  the  environment 
and  conponent  susceptibility,  as  well  as  uncertainties  in  modeling,  testing, 
judgment,  etc.  In  addition,  the  distribution  generated  in  this  way  can  be 
used  to  present  a  range  of  values  for  the  probability  of  survival.  Although 
the  discussion  of  this  approach  has  concentrated  on  taking  averages,  it  is 
possible  to  use  other  measures,  for  example,  the  probability  of  survival 
exceeded  in  at  least  a  certain  percentage  (e.g.,  95%)  of  cases  with  respect  to 
the  random  uncertainty.  The  in^ortant  thing  to  recognize  is  that  this 
approach  realistically  measures  system  performance  in  the  environments  it  is 
likely  to  encounter,  because  it  accounts  for  both  the  magnitude  of  the  threat 
euid  the  frequency  of  its  occurrence. 

One  variation  of  this  approach  has  been  applied  to  two  simple  systems  at 
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LLL.  These  analyses  used  the  computer  program  FAST  to  sample  the  random 
and  systematic  uncertainties,  and  the  circuit/systems  computer  program  NET-2 
to  develop  Fjme  of  the  internal  coupling  data.  Both  of  these  programs  have 
shortcomings  (e.g.,  FAST  assumes  a  linear  transfer  function  to  describe 
coupling),  but  their  use  illustrates  the  methodology  described  above.  In 
fact,  the  output  of  this  type  of  assessment  compares  well  with  experimentally 
based  data.  These  results  are  discussed  in  the  next  section. 

6.0  VALIDATION  EXPERIMENTS 


The  first  validation  experiment  used  EMP  radiation  of  a  monopole  antenna 
with  a  microwave  diode  load.  The  second  used  a  transistor  multivibrator 
circuit,  which  was  driven  by  a  potentially  damaging  electrical  pulse.  Both 
experiments,  though  simple,  had  the  features  necessary  for  validating  the 
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probabilistic  approach.  We  obtained  input  data  for  the  FAST  computer  program 
from  the  experiments  and  from  numerical  calculations.  We  used  FAST  to  predict 
the  overall  system  probability  of  failure,  as  a  function  of  the  applied 
environmental  stress. 

6.1  MONOPOLE A>IOOE  EXPERIMENT 

We  assembled  a  monopole  antenna  with  a  diode  load  on  the  LLL  Transient 
18 

Electromagnetic  Range,  as  illustrated  in  Fig.  6.1.  This  simple  system 
embodies  all  of  the  ingredients  needed  to  demonstrate  the  application  of  the 
FAST  program  to  assessment.  Device  burnout  is  specified  by  diode  fragility 
curves,  the  environment  appears  as  the  incident  electromagnetic  field  (from 
the  monocone  pulse  antenna),  and  the  network  transfer  function  relates  the 
incident  field  level  to  the  energy  collected  by  the  monopole  antenna  and 
delivered  to  the  diode  load. 

The  experiment  provided  simple  systems  tests.  If  the  amplitude  of  the 
5-ns  pulse  generated  by  the  pulser,  radiated  to  the  monopole,  and  delivered  to 
the  diode  load  is  sufficently  large,  the  diode  will  burn  out.  In  each  test, 
only  one  pulse  was  delivered  to  the  diode  load  and  each  diode  load  was  used 
only  once.  At  each  level  of  environmental  stress  (the  incident  electromagnetic 
field) ,  FAST  predicts  the  probability  of  system  failure.  Therefore,  the 
experiment  was  performed  for  three  different  levels  of  field  intensity,  with  a 
sample  lot  of  26  diodes  in  each  case.  Failure  of  a  diode  was  defined  as  a 
12-fold  increase  in  reverse  leakage  current. 

6.1.1  Fragility  Curves 

To  determine  fragility  curves,  it  was  necessary  to  obtain  failure  data 

for  the  1N23B  point-contact  microwave  diode  that  was  applicable  in  the  short- 

pulse  (5-ns)  region.  We  performed  separate  tests  to  obtain  this  data.  Four 

19 

hundred  devices  were  tested  in  the  configuration  illustrated  in  Fig.  6.2. 

The  burnout  criterion  was  based  on  the  distribution  of  leakage  current  of  234 
devices  before  testing.  The  mean  leakage  current  was  7.0  yA,  with  a  sample 
standard  deviation  of  5.93  yA.  The  test  configuration  of  Fig.  6.2  uses  a 
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mercury  pulse  generator  with  adjustable  pulse  amplitude  and  a  5-ns  pulse 
width.  Energy  delivered  to  the  coaxial  line  (in  joules)  is  expressed  as 


where  T  is  the  pulse  width  in  seconds,  V  is  the  pulse  voltage 
P  P 

(attenuated  by  a  factor  of  10),  and  is  the  line  impedance  (50  S^) .  The 
diode  was  mounted  into  a  coaxial  fixture  and  probes  CT-1  and  CT-3  were  used  to 
monitor  current  in  the  diode  and  voltage  on  the  line  with  the  diode.  The 
attenuator  diminished  reflected  pulses  between  the  load  and  the  pulse 
generator . 

We  performed  the  diode  tests  at  several  levels  to  obtain  estimates  of  the 
fragility  curves  over  several  percentiles.  IVenty-six  diodes  were 
single-pulse  tested  at  each  voltage  level  (52  were  tested  at  80  V) ,  and 
checked  for  failure.  A  summary  of  the  results  is  shown  in  Table  6.1. 
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FIG.  6.2.  Arrangement  used  to  obtain  short-pulse  diode  burnout  data  (adapted 
from  Ref.  18) . 


TABLE  6.1.  Summary  of  diode  tests. 


Pulse 

voltage,  Energy,  J 

Number 

tested 

Number 

failed*^ 

Estimated 
probability 
of  failure  (0f) 

90%  confidence 
limits  for 
probability 
of  failure 

15 

2.25  X  10“® 

26 

1 

0.038 

(0,  0.100) 

30 

9.0  X  lo"® 

26 

4 

0.154 

(0.038, 

0.270) 

40 

1.6  X  lo"^ 

26 

9 

0.346 

(0.195, 

0.497) 

45 

2.025  X  lo"^ 

26 

16 

0.615 

(0.459, 

0.771) 

50 

2.5  X  lO"^ 

26 

18 

0.692 

(0.544, 

0.849) 

60 

3.6  X  lo"^ 

26 

19 

0.731 

(0.588, 

0.874) 

80 

6.4  X  lO"^ 

52 

44 

0.827 

(0.738, 

0.916) 

100 

1.0  X  10"® 

26 

25 

0.962 

(0.986, 

1.0) 

^Diode  failure  occurs  if  reverse  leakage  current  exceeds  84  )iA. 

*’Pulse  voltage  is  voltage  into  coax  leading  to  diode  and  is  equal  to  the 
mercury  pulser  voltage  divided  by  10. 
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Point  and  90%  confidence  interval  estimates  for  the  probability  of 
failure,  p^,  are  based  on  the  following  formulas: 

p  =  number  of  diodes  failing  ^ 

^  n 


,A  A  , 


where  n  is  the  number  of  diodes  tested.  These  estimates  are  given  in  the  last 
two  columns  of  Table  6.1.  Empirical  cumulative  distribution  functions  based 
on  these  estimates  are  given  in  Fig.  6.3.  The  middle  curve  is  the  best 
estimate  of  the  diode  fragility,  based  on  the  estimates  of  p^.  Figure  6.3 
also  shows  the  lower  and  upper  limits  on  the  fragility  due  to  the  systematic 
uncertainty  of  estimating  it  from  test  data. 


6.1.2  Transfer  Function 

We  obtained  the  transfer  function  that  relates  the  incident  electro¬ 
magnetic  field  level  at  the  roonopole  to  the  energy  delivered  to  the  diode 

20 

load,  with  the  help  of  the  computer  program  WT-MBA/LLLIB .  This  program 

permits  the  modeling  of  wire  structures,  such  as  the  monopole,  with  a  series 

of  short  interconnected  segments.  The  numerical  model  of  the  1.13-m  roonopole 

over  a  ground  plane  resembles  a  2.26-m  dipole  in  free  space,  with  a  100-J^ 

load  as  its  center.  Figure  6.4  shows  the  calculated  voltage  across  one  half 

of  the  100-f2  load  for  a  1  V/m  electric  field  amplitude,  plane-wave 

incidence,  1-ns  rise  and  fall  times,  and  a  5-ns  pulse  width  (FWHM)  .  'ihe 

cumulative  energy  delivered  to  the  50-51  load  is  shown  in  Fig.  6.5  for  the 

-12 

positive  half  cycles.  The  asymptotic  value  of  1.35  x  10  .T  uas  used  in 
the  transfer  function  for  FAST. 


6.1.3  Results 

To  evaluate  the  assessment  methodology,  we  took  two  approaches  to  develop 
data  for  comparison  with  the  probabilistic  estimate  of  system  failure.  One 
source  of  data  was  the  experiment  involving  the  monopole/dipole  network  shown 


33 


in  Fig.  6.1.  The  diode  fixture  and  cable  attached  to  the  nonopole  are  the 
same  as  that  used  in  establishing  the  diode  burnout  data.  Three  levels  of 
incident  electric  field,  256  V/ro,  372  V/m,  and  460  V/m,  were  used  in  the 
experiment.  At  each  level,  26  diodes  were  tested.  The  results  of  the  tests 
are  summarized  in  Table  6.2. 
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Load  energy  --  10  ^  Voltage 


ted  voltage  across  a  50-^2  load  for  a  2.26-in  dipole 


FIG.  6.5.  Cumulative  energy  into  a  50-i2  load  on  a  1.13-m  roonopole 
for  a  5-ns,  1-V/m  incident  plane-wave  pulse. 


TABLE  6.2.  Percentiles,  P^,  of  the  probability  distribution  of  p^,  the 
probability  of  system  failure,  at  three  incident  electric  fields. 


Probability 
that  P^  <  P^ 

Percentiles  (P^) 

at  256  V/m 

at  372  V/m 

at  460  V/m 

0.01 

0.056 

0.313 

0.513 

0.10 

0.102 

0.388 

0.607 

0.30 

0.118 

0.441 

0.658 

0.50 

0.135 

0.490 

0.679 

0.70 

0.155 

0.528 

0.700 

0.90 

0.217 

0.583 

0.750 

0.99 

0.337 

0.675 

0.838 

A  second  source  of  validation  data  was  an  analytical  computation  of  the 
probability  of  system  failure.  This  analysis  was  based  on  the  assumption  that 
both  the  diode  failure  threshold  and  the  energy  applied  to  the  system  are 
lognormal  random  variables.  This  assumption  is  consistent  with  the 
experimental  data,  and  the  values  of  the  parameters  or  the  probability 
distributions  were  derived  from  these  data.  The  analysis  is  based  on  the  fact 
that  the  probability  of  system  failure,  p^,  can  be  computed  from  the 
relationship 

Pj  =  P(E  >  T) 

=  P  jjln  E  -  In  T)J  >  0  , 

where  E  denotes  the  applied  energy  and  T  denotes  the  failure  threshold.  Since 
both  E  and  T  are  lognormal  random  variables,  the  difference, 

W  =  In  E  -  In  T  , 
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is  a  nocmal  random  variable.  Thus,  the  probability  of  failure  is  the 
probability  that  W,  with  the  appropriate  mean  and  variance,  is  greater  than 
zero. 

The  results  of  this  probabilistic  analysis  are  summarized  in  Table  6.3, 
along  with  the  validation  estimates — one  experimental  and  one  analytical.  The 
probabilistic  estimate  of  the  probability  of  failure  given  in  the  last  column 
of  Table  6.3  is  based  on  the  FAST  program.  The  inputs  to  the  progreun  were  the 
environment,  transfer  function,  and  fragility  data  described  earlier.  The 
output  of  FAST  is  the  probability  distribution  for  p^,  the  probability  of 
system  failure.  Selected  percentiles  of  the  output  distribution  appear  in 
Table  6.2.  The  point  estimates  of  p^,  given  in  Table  6.3,  are  the  50th 
percentiles  in  Table  6.2. 

In  general  there  is  good  agreement  between  the  validation  results  and  the 
estimate  based  on  the  probabilistic  analysis  using  FAST.  Of  course,  this 
comparison  involves  a  very  simple  system.  The  experimental  estimate  of  p^ 
is  highest  at  all  three  electric  fields,  indicating  a  possible  bias  in  one  or 
more  of  the  methods.  Several  factors  affect  the  comparison: 

•  The  experimental  estimate  is  based  on  a  relatively  small  sample  of  26 
units  (at  each  field  intensity) . 

•  The  analytical  approach  assumed  lognormal  distributions  (an 
approximation) . 

•  In  the  probabilistic  analysis,  all  systematic  uncertainties  were 
considered  negligible  except  that  associated  with  the  fragility  curves  for  the 
diode. 


TABLE  6.3.  Compeurison  of  experimental,  analytical,  and  probabilistic  results. 


Electric  field,  V/m 

Probability  of  failure  (p^) 

Exper imental 

Analytical 

Probabilistic  (FAST) 

256 

0.192 

0.172 

0.135 

372 

0.580 

0.460 

0.490 

460 

0.692 

0.645 

0.679 
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6.2  MULTIVIBRATOR  EXPERIMENT 


In  the  multivibrator  experiment,  we  used  both  available  analysis  tools 

and  an  existing  component  data  base  in  combination  with  laboratory  tests  for 

the  validation  study.  For  analysis  and  experiment,  a  conventional 

two-battery-biased,  collector-coupled  monostable  multivibrator  circuit,  using 

two  2N918  transistors,  was  contrived.  This  circuit  was  modeled  and  analyzed 

21 

with  version  9.1  of  the  computer  program  NET-2.  Published  failure  data  on 
the  2N918  were  used  to  set  the  component  fragility.  In  the  laboratory  tests, 
the  multivibrator  was  subjected  to  a  stress  environment  of  electrical  pulses, 
injected  through  diodes  into  the  base  of  each  of  the  transistors,  to  verify 
the  analytic  predictions  of  failure  obtained  from  the  NEr-2  simulation 
results.  The  configuration  used  for  the  laboratory  tests  is  shown  in  Fig.  6.6. 

6.2.1  Circuit  Analysis  with  NEr-2 

A  preliminary  examination  of  the  multivibrator  circuit  indicated  that  the 

transistors  would  be  the  components  most  susceptible  to  burnout.  Previous 
21 

data  on  the  2N918  show  that  failure  is  likely  for  reverse  voltages  near 

13.5  V  for  the  emitter-base  junction,  for  a  l-ps  pulse  width,  with  failure 

currents  of  0.4  to  0.5  A.  After  some  preliminary  runs  with  NET-2  established 

the  magnitude  of  the  required  burnout  pulse,  we  analyzed  the  circuit 

with  the  Monte  Carlo  option  of  the  code.  A  100-sample  Monte  Carlo  solution 

was  found  for  a  fixed  point  in  time  (5.75  ps) ,  where  only  the  parameters 

Vbe  (breakdown  voltage),  R^g,  and  were  varied.  These  parameters 

are  highly  significant  in  the  failure  predictions,  and  Gaussian  parameter 

distributions  were  used  to  represent  their  variations.  An  average  value  of 

8.7  V  for  V  was  calculated  from  previous  results,  and  the  average  value  of 
BE* 

Rgg  was  estimated  as  10  H.  The  3a  points  for  NET-2  were  1.1  V  and  5  Q. 

The  pulser  voltage  was  varied  between  64  and  68  V. 

Table  6.4  presents  an  example  of  the  output  quantities  calculated  by  NET-2. 
According  to  these  predictions,  failure  is  about  equally  likely  for  the  two 
transistors. 
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Monostable  multivibrator  circuit 
(partial  schematic) 


PIG.  6.6.  Test  configuration  for  multivibrator  circuit  burnout  experiment. 


TABLE  6.4.  Breakdown  voltages  across  the  base-emitter  junctions  of  two  tran¬ 
sistors,  calculated  by  NET-2. 


Breakdown  voltage  (V  ) , 

d£* 

V 

Transistor 

Minimum 

Average 

Maximum 

Std  dev 

T1 

-15.1 

-13.8 

-12.4 

0.484 

T2 

-15.1 

-13.8 

-12.3 

0.482 

6.2.2  FAST  Analysis 


Using  the  output  of  NSr-2,  we  developed  fragility  curves  for  the 
transistors  (similar  to  the  curves  illustrated  in  Fig.  6.3).  The  uncertainty 
limits  were  based  on  confidence  interval  estimates  of  the  mean.  The 


environmental  data  used  were  the  ,  values  with  a  nominal  voltage  of 

Pulse  ^ 

65  V.  The  estimate  of  the  probability  of  system  survival,  p^,' based  on  the 
probabilistic  analysis,  is  0.368. 


6.2.3  Experimental  Results 

Laboratory  tests  were  performed  on  the  multivibrator  circuit,  using  the 
urangement  shown  in  Fig  6.6.  The  Hewlett-Packard  pulse  generator  was  used  to 
check  the  normal  operation  of  the  monostable  circuit.  Each  time  the  0.5-ys 
pulser  is  actuated,  a  10-ys  pulse  is  observed  in  the  output  from  the 
multivibrator.  Initial  burnout  tests  were  performed  at  65  V  at  the  output  of 
the  10 X  attenuator  connected  to  the  mercury  pulser.  Only  a  single  burnout 
pulse  was  applied  to  the  circuit.  After  each  pulse,  the  cicuit  was  considered 
to  have  survived  if  it  continued  to  function  normally.  Transistors  T1  and  T2 
were  replaced  after  each  test.  The  replaced  transistors  were  subsequently 
checked  on  a  curve  tracer  to  determine  which  device  had  burned  out.  Based  on 
this  functional  criterion,  8  out  of  20  circuits  survived;  thus,  the 
experimental  estimate  of  survival  is  p^  >  0.4.  This  agrees  closely  with  the 
estimate  based  on  the  FAST  code,  particularly  since  only  20  units  were  tested 
exper imen tally. 

Since  the  fragility  data  were  based  on  an  assumption  of  failure  whenever 
the  beta  gain  factor  of  a  transistor  exceeded  a  10%  degradation,  a  second 
experiment  involving  40  circuits  was  run  using  the  10%  degradation  as  the 
failure  criterion.  At  this  level,  the  circuit  can  still  function;  thus,  an 
estimate  of  the  probability  of  survival  based  on  10%  degradation  is  close  to  a 
lower  bound  of  the  survival  probability.  Among  the  40  circuits  tested,  11 
survived  using  this  criterion;  thus,  the  estimate  of  the  probability  of 
survival  is  p  =  0.275.  This  figure  is  lower  than  both  the  FAST  estimate 
and  the  estimate  based  on  a  functional  criterion  of  failure.  However,  since 
about  half  of  the  circuits  continued  to  function  after  failure  (using  the  10% 
degradation  criterion),  this  level  of  gain  degradation  is  not  a  realistic 
failure  criterion  for  this  circuit. 

7.0  HARDENINS  AND  PROTBCTICM  OPTICRIS 

A  probabilistic  design  methodology  is  a  logical  way  to  approach 
vulnerability  assessment  analysis  and  hardness  specification.  There  eu:e 
different  options  to  consider  when  one  is  faced  with  assessing  and  hardening 
systems  in  quite  different  stages  of  development.  The  emphasis  here  will  be 
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more  on  assessment  for  hardening  when  the  system  is  already  developed  or 
fielded.  The  hardening  options  will  necessarily  be  tied  closely  to  the 
results  of  assessment  and  to  the  penalties  that  would  be  incurred  by  a 
redesign  or  retrofit  for  heurdening  purposes.  Actual  hardening  options  for 
existing  systems  may  be  quite  limited.  In  the  extreme,  an  operational  ch2mge 
may  be  necessary.  A  new  design  would  be  most  flexible  in  terms  of  system 
engineering  studies  for  hardening  options.  In  all  cases,  however,  it  is  a 
question  of  choosing  the  appropriate  set  of  hardening  options  when  faced  with 
given  operating  constraints. 

There  cire  several  types  of  protection  methods  available,  one  or  all  of 
which  may  be  used  in  a  particular  protection  option.  A  system  protection 
design  approach,  referred  to  as  "apportionment  of  protection,"  is  often  used. 
The  idea  is  to  distribute  the  protection  so  as  to  avoid  a  heavy  reliance  on  a 
single  protection  method,  such  as  a  shield.  A  well-balanced  apportionment 
scheme  would  appear  to  offer  the  least  risk  from  an  uncertainties  viewpoint, 
as  significant  factors  of  safety  could  overcome  the  variations  in  each  method 
used  in  the  apportionment  scheme.  If  uncertainties  could  be  quantified 
sufficiently  emd  if  the  system  protection  and  environment  interaction  were 
sufficiently  well  understood,  then  the  probabilistic  approach  could  be  used  to 
overcome  the  heavy  reliance  on  safety  factors  in  protection. 


8.0  SUMMARY 


In  this  paper,  we  examined  the  general  problem  of  uncertainties  and  their 
impact  on  high-altitude  QIP  vulnerability  assessment  of  military  systems. 
Typical  uncertainties  in  coupling  and  susceptibility  have  been  presented. 
Furthermore,  the  main  methodologies  used  in  vulnerability  assessment  have  been 
reviewed  and  their  respective  handling  of  the  uncertainties  discussed.  One 
such  methodology,  based  on  probabilistic  techniques,  has  been  peurtially 
validated  at  LLL  with  two  simple  system  tests,  and  the  results  were  discussed. 
In  addition,  we  discussed  statistical  test  techniques  used  to  obtain  the 
necessary  data  to  formulate  the  vulnerability  issue  in  a  probabilistic 
framework. 

Coupling  uncertainties  can  be  quite  high.  For  example,  uncertainties  in 
test  data  for  internal  cable  currents  of  aircraft  cem  be  as  high  as  +2Q  dB  for 
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tests  in  a  full-scale  free-field  simulator.  This  includes  measurement, 
extrapolation,  and  intersystem  and  intrasystem  uncertainties,  all  combined  as 
the  square  root  of  the  sum  of  squares.  The  coupling  uncertainty  will  be  even 
higher  if  analytical  techniques  are  used. 

Inherent  variability  in  the  threshold  failure  levels  of  components  when 
subjected  to  certain  types  of  electromagnetic  environments  is  a  large  source 
of  uncertainty  in  doing  a  subsystem  assessment.  Frequently,  more  closely 
controlled  features  of  a  circuit  that  surrounds  a  component  cause  less 
variation  in  the  susceptibility  at  a  set  of  circuit  interface  terminals  than 
would  be  observed  in  the  component  alone.  Component  parts  may  have  one  or  two 
orders  of  magnitude  of  uncertainty  in  failure  levels  unless  subject  to  parts 
control  procedures.  Past  programs  have  shown  that  calculated  threshold  levels 
constitute  a  high-reliability  lower  bound  on  true  thresholds  as  determined  by 
tests.  Failure  test  data  also  indicate  margins  of  the  order  of  +13  dB  for 
aircraft-type  equipment. 

There  is  considerable  diversity  in  methodologies  applied  to  assessing  the 
vulnerabilities  of  systems  to  EMPs.  This  is  particularly  true  of  how 
uncertainties  in  the  assessment  variables  are  treated,  especially  how 
uncertainties  are  combined  for  the  ultimate  evaluation  of  margins  of  safety 
and  probabilities  of  survival.  One  method  based  on  probabilistic  analysis 
offers  an  efficient  way  of  combining  uncertainties  with  a  minimum  of 
assumptions.  Thus,  many  of  the  shortcxxnings  of  the  more  analytical  methods 
are  avoided.  In  this  study,  estimates  (based  on  probabilistic  analysis)  of 
the  probabilities  of  survival  for  two  simple  systems  compared  favorably  to 
experimental  results.  This  indicates  that  an  assessment  method  based  on 
probabilistic  analysis  has  potential  for  effectively  accommodating 
uncertainties  in  the  assessment  variables. 

As  far  as  uncertainty  reduction  is  concerned,  reduction  in  certain  areas 
seems  much  more  plausible  th^m  in  others.  In  coupling,  reduction  of 
measurement  uncertainties  depends  largely  on  novel  simulator  and  probe 
technology.  The  largest  payoff,  however,  will  be  improved  extrapolation 
techniques,  improved  cable  layout  control  to  minimize  intersystem  differences, 
and  the  conducting  of  tests  in  the  power-on  mode.  In  the  susceptibility 
domain,  with  strict  control  of  components  and  circuits  configuration,  the 
uncertainties  can  perhaps  be  reduced  to  +6  dB. 
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